Wazuh¶
Description¶
Wazuh is an open-source security platform that provides both XDR and SIEM protection for endpoints and cloud workloads. It combines endpoint security, threat intelligence, security operations, and cloud security into a single agent and platform architecture. Being open-source gives Wazuh the advantage of being flexible, scalable, with no vendor lock-in, no license cost, and large community support.
Wazuh integrates the CIS (Center for Internet Security) Benchmarks into its Security Configuration Assessment (SCA) module to help enforce secure system configurations. Compliance is continuously monitored with periodic scans and real-time endpoint monitoring. Wazuh maps findings to regulatory compliance frameworks such as PCI-DSS, HIPAA, and NIST controls, providing a comprehensive approach to governance.
Wazuh installation¶
Linux¶
-
Open these ports on your server's firewall and then restart it:
sudo firewall-cmd --permanent --add-port=1514/tcp sudo firewall-cmd --permanent --add-port=1514/udp sudo firewall-cmd --permanent --add-port=1515/tcp sudo firewall-cmd --permanent --add-port=55000/tcp sudo firewall-cmd --permanent --add-port=514/tcp sudo firewall-cmd --permanent --add-port=514/udp sudo firewall-cmd --reload -
Run the following command to begin the automated install:
Initial password
Once completed, the terminal will give you an initial password for logging in to the Wazuh web console.
-
Access the Wazuh web console via
https://<server-ip>:443using your initial default credentials.
Add agents¶
Windows¶
Agents are the endpoints that are monitored by Wazuh.
-
Open the Wazuh console and click on the button that says Deploy a new agent.
-
On the next screen, provide your system information and copy the installation command. It should look something like this:
-
Then, use the following command to start the Wazuh agent service:
-
Use the Wazuh Agent Windows application to verify that it's running:
Wazuh Agent -
The Windows agent should now appear on the Wazuh console.
Linux (Fedora)¶
-
Open the Wazuh console and click on the button that says Deploy a new agent.
-
On the next screen, provide your system information and copy the installation command. It should look something like this:
-
Once finished, run these commands to enable the Wazuh Agent:
-
Run this command on both the server and client, so as to prevent Wazuh updates from breaking the configuration:
-
The Linux agent now appears on the Wazuh console.
CIS Benchmark scans¶
CIS Microsoft Windows 11 Enterprise Benchmark¶
Click on Endpoints, then click on a Windows agent. A CIS Benchmark scan should have automatically started by now.
Once the scan has completed, go over the results to see what vulnerabilities there are on your system. Your score should be somewhere around 30%, which is to be expected:
CIS Microsoft Windows 11 Enterprise Benchmark results
These checks ensure that the system is compliant with CIS standards, and include controls such as setting the most secure password length.
Clicking on a control test expands a panel showing the rationale for the control, how to remediate it, a description of the policy setting, and other information. Here, you can see the registry values that were checked, and how to remediate the failed control check by creating specific entries in the Windows Registry Editor:
CIS Distribution Independent Linux Benchmark¶
Go back to Endpoints and click on a Linux agent. Look over the CIS Benchmark results. This time, I will show you an example of how to remediate a failed control check manually.
The remediation states that I have to write a few lines to a configuration file that ensures login and logout events are collected:
Open the file in a text editor:
Copy and paste the following lines and write the changes to the file:## Ensure login and logout events are collected
-w /var/log/faillog
-p wa
-k logins
-w /var/log/lastlog
-p wa
-k logins
-w /var/log/tallylog
-p wa
-k logins
It's not the most practical method of system hardening, but there is a more time-efficient way to harden a system automatically.